855fa6e9dd58efa381e314f1356511c313531c3fc0685cb2b265142edf5818a2

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/07/2026, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
slitz/Programs/Output/ServerScraper/ServerScraper.txt
Size 14B
Sample260708-kkpg3adv7z
SHA256 855fa6e9dd58efa381e314f1356511c313531c3fc0685cb2b265142edf5818a2
MD5 21eb6f546c326939ae3545906a9d60e5
SHA1 9bd4457c84b06c591d799b0c3e2db6f4877a4866
SHA512 757d24eca90579434821f950b8d78bc2e5d018d1947d4ecf75d76bb7cffd89936ba524b5cca6645e3bb95eb1fe56add64a93cf1306fcf394051696ac8272625f
MD5 SHA1 SHA512

Score

3^/10

ransomware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3376	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 3376	2624	cmd.exe	81

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\slitz\Programs\Output\ServerScraper\ServerScraper.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\slitz\Programs\Output\ServerScraper\ServerScraper.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads